Fuzz introspector: fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
8 8 10 :

['std::__1::vector , std::__1::allocator >, std::__1::allocator , std::__1::allocator > > >::end[abi:ne180100]()', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+ , std::__1::allocator >(char const*, std::__1::basic_string , std::__1::allocator > const&)', 'std::__1::basic_string , std::__1::allocator > std::__1::operator+[abi:ne180100] , std::__1::allocator >(std::__1::basic_string , std::__1::allocator > const&, char const*)', 'std::__1::basic_string , std::__1::allocator >::append[abi:ne180100](std::__1::basic_string , std::__1::allocator > const&)', 'bool std::__1::operator!=[abi:ne180100] , std::__1::allocator >*>(std::__1::__wrap_iter , std::__1::allocator >*> const&, std::__1::__wrap_iter , std::__1::allocator >*> const&)', 'std::__1::basic_string , std::__1::allocator >::c_str[abi:ne180100]() const', 'Fatal(char const*, ...)', 'std::__1::__wrap_iter , std::__1::allocator >*>::operator*[abi:ne180100]() const', 'std::__1::basic_string , std::__1::allocator >::basic_string[abi:ne180100]()', 'std::__1::__wrap_iter , std::__1::allocator >*>::operator++[abi:ne180100]()']

8 8 EdgeEnv::LookupVariable(std::__1::basic_string ,std::__1::allocator >const&) call site: 00000 /src/ninja/src/graph.cc:457
2 2 3 :

['Edge::~Edge()', 'operator delete(void*)', 'std::__1::vector >::pop_back()']

2 2 ManifestParser::ParseEdge(std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:348
0 12 2 :

['_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2B8ne180100ILi0EEEPKc', 'Lexer::Error(std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator >*)']

0 12 ManifestParser::ParsePool(std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:128
0 4 1 :

['BindingEnv::LookupRule(std::__1::basic_string , std::__1::allocator > const&)']

0 4 BindingEnv::LookupRule(std::__1::basic_string ,std::__1::allocator >const&) call site: 00000 /src/ninja/src/eval_env.cc:50
0 0 None 28 28 ReadFile(std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/util.cc:444
0 0 None 8 504 ManifestParser::ParsePool(std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:101
0 0 None 8 351 ManifestParser::ParsePool(std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:118
0 0 None 8 8 ReadFile(std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >*,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/util.cc:451
0 0 None 6 2662 ManifestParser::Parse(std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:80
0 0 None 4 333 ManifestParser::ParseDefault(std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:196
0 0 None 4 241 ManifestParser::ParseFileInclude(bool,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:421
0 0 None 4 227 ManifestParser::ParseFileInclude(bool,std::__1::basic_string ,std::__1::allocator >*) call site: 00000 /src/ninja/src/manifest_parser.cc:428

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 sprintf [call site] 00001
1 fopen [call site] 00002
1 fwrite [call site] 00003
1 fclose [call site] 00004
1 RealDiskInterface::RealDiskInterface() [function] [call site] 00005
2 DiskInterface::DiskInterface() [function] [call site] 00006
3 FileReader::FileReader() [function] [call site] 00007
1 State::State() [function] [call site] 00008
2 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::HashMap(unsigned int, float) [function] [call site] 00009
3 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::init(unsigned int, float) [function] [call site] 00010
4 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::max_load_factor(float) [function] [call site] 00011
5 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::rehash(unsigned long) [function] [call site] 00012
6 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::max_size() const [function] [call site] 00013
6 __assert_fail [call site] 00014
6 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::rebuild(unsigned int) [function] [call site] 00015
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::max_load_factor() const [function] [call site] 00016
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::alloc_bucket(unsigned int) [function] [call site] 00017
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::alloc_index(unsigned int) [function] [call site] 00018
7 __clang_call_terminate [call site] 00019
8 __cxa_begin_catch [call site] 00020
6 _ZNK7emhash87HashMapI11StringPieceP4NodeNSt3__14hashIS1_EENS4_8equal_toIS1_EENS4_9allocatorINS4_4pairIS1_S3_EEEENS_13DefaultPolicyEE8hash_keyIS1_TnNS4_9enable_ifIXaantsr3std11is_integralIT_EE5valuentsr3std7is_sameISH_NS4_12basic_stringIcNS4_11char_traitsIcEENS9_IcEEEEEE5valueEjE4typeELj0EEEmRKSH_ [function] [call site] 00021
6 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::find_unique_bucket(unsigned long) [function] [call site] 00022
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::hash_main(unsigned int) const [function] [call site] 00023
8 _ZNK7emhash87HashMapI11StringPieceP4NodeNSt3__14hashIS1_EENS4_8equal_toIS1_EENS4_9allocatorINS4_4pairIS1_S3_EEEENS_13DefaultPolicyEE8hash_keyIS1_TnNS4_9enable_ifIXaantsr3std11is_integralIT_EE5valuentsr3std7is_sameISH_NS4_12basic_stringIcNS4_11char_traitsIcEENS9_IcEEEEEE5valueEjE4typeELj0EEEmRKSH_ [function] [call site] 00024
8 __clang_call_terminate [call site] 00025
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::kickout_bucket(unsigned int, unsigned int) [function] [call site] 00026
8 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::find_empty_bucket(unsigned int, unsigned int) [function] [call site] 00027
8 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::find_prev_bucket(unsigned int, unsigned int) const [function] [call site] 00028
8 __clang_call_terminate [call site] 00029
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::find_last_bucket(unsigned int) const [function] [call site] 00030
7 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::find_empty_bucket(unsigned int, unsigned int) [function] [call site] 00031
7 __clang_call_terminate [call site] 00032
4 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::rehash(unsigned long) [function] [call site] 00033
2 BindingEnv::BindingEnv() [function] [call site] 00034
3 Env::Env() [function] [call site] 00035
2 Rule::Phony() [function] [call site] 00036
3 Rule::Rule(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00037
2 BindingEnv::AddRule(std::__1::unique_ptr<Rule const, std::__1::default_delete<Rule const> >) [function] [call site] 00038
3 Rule::name() const [function] [call site] 00039
3 BindingEnv::LookupRuleCurrentScope(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00040
3 __assert_fail [call site] 00041
3 Rule::name() const [function] [call site] 00042
2 State::AddPool(Pool*) [function] [call site] 00043
3 Pool::name() const [function] [call site] 00044
3 State::LookupPool(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00045
3 __assert_fail [call site] 00046
3 Pool::name() const [function] [call site] 00047
2 State::AddPool(Pool*) [function] [call site] 00048
2 BindingEnv::~BindingEnv() [function] [call site] 00049
3 Env::~Env() [function] [call site] 00050
2 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::~HashMap() [function] [call site] 00051
3 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::clearkv() [function] [call site] 00052
3 __clang_call_terminate [call site] 00053
1 ManifestParserOptions::ManifestParserOptions() [function] [call site] 00054
1 ManifestParser::ManifestParser(State*, FileReader*, ManifestParserOptions) [function] [call site] 00055
2 Parser::Parser(State*, FileReader*) [function] [call site] 00056
3 Lexer::Lexer() [function] [call site] 00057
4 StringPiece::StringPiece() [function] [call site] 00058
1 Parser::Load(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*, Lexer*) [function] [call site] 00059
2 __cxa_guard_acquire [call site] 00060
2 Metrics::NewMetric(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) [function] [call site] 00061
3 Metric::Metric() [function] [call site] 00062
2 __cxa_guard_release [call site] 00063
2 ScopedMetric::ScopedMetric(Metric*) [function] [call site] 00064
3 (anonymous namespace)::HighResTimer() [function] [call site] 00065
2 Lexer::Error(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*) [function] [call site] 00066
3 StringPiece::AsString() const [function] [call site] 00067
3 snprintf [call site] 00068
2 __cxa_guard_abort [call site] 00069
2 ScopedMetric::~ScopedMetric() [function] [call site] 00070
3 (anonymous namespace)::HighResTimer() [function] [call site] 00071
3 __clang_call_terminate [call site] 00072
1 ManifestParser::~ManifestParser() [function] [call site] 00073
2 Parser::~Parser() [function] [call site] 00074
1 State::~State() [function] [call site] 00075
2 BindingEnv::~BindingEnv() [function] [call site] 00076
2 emhash8::HashMap<StringPiece, Node*, std::__1::hash<StringPiece>, std::__1::equal_to<StringPiece>, std::__1::allocator<std::__1::pair<StringPiece, Node*> >, emhash8::DefaultPolicy>::~HashMap() [function] [call site] 00077
1 RealDiskInterface::~RealDiskInterface() [function] [call site] 00078
2 DiskInterface::~DiskInterface() [function] [call site] 00079
3 FileReader::~FileReader() [function] [call site] 00080